🐛 fix start up config error for appsec and review doc for appsec tls (#300)

* 🐛 fix start up config error for appsec * :doc: add documentation on appsec variables and missing conf parameter * 🍱 fix lint * 🍱 fix lint * 🍱 fix lint * 🍱 fix after lot of tests * update exemple tls with new variables tested * fix exemple appsec with release and not localplugin --------- Co-authored-by: mhx <mathieu@hanotaux.fr>
2026-07-21 11:38:59 +02:00 · 2025-12-21 21:52:19 +01:00
parent c26923dee5
commit 892909b9b8
10 changed files with 180 additions and 113 deletions
@@ -1,7 +1,9 @@
 # Example
+
 ## Using https communication and tls authentication with Crowdsec

 ##### Summary
+
 This example demonstrates the use of https between the Traefik plugin and the Crowdsec LAPI.

 It is possible to communicate with the LAPI in https and still authenticate with API key.
@@ -17,7 +19,9 @@ In that case the setting **crowdsecLapiTLSInsecureVerify** must be set to true.
 It is recommended to validate the certificate presented by Crowdsec LAPI using the Certificate Authority which created it.

 You can provide the Certificate Authority using:
-* A file path readable by Traefik
+
+- A file path readable by Traefik
+
 ```yaml
 http:
  middlewares:
@@ -26,9 +30,11 @@ http:
        bouncer:
          crowdsecLapiTlsCertificateAuthorityFile: /etc/traefik/certs/crowdsecCA.pem
 ```
-* The PEM encoded certificate as a text variable
+
+- The PEM encoded certificate as a text variable

 In the static file configuration of Traefik
+
 ```yaml
 http:
  middlewares:
@@ -36,15 +42,17 @@ http:
      plugin:
        bouncer:
          crowdsecLapiTlsCertificateAuthority: |-
-              -----BEGIN CERTIFICATE-----
-              MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
-              MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
-              ...
-              C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
-              Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
-              -----END CERTIFICATE-----
+            -----BEGIN CERTIFICATE-----
+            MIIEBzCCAu+gAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwgZQxCzAJBgNVBAYTAlVT
+            MRAwDgYDVQQHDAdTZWF0dGxlMRMwEQYDVQQIDApXYXNoaW5ndG9uMSIwIAYDVQQK
+            ...
+            C6qNieSwcvWL7C03ri0DefTQMY54r5wP33QU5hJ71JoaZI3YTeT0Nf+NRL4hM++w
+            Q0veeNzBQXg1f/JxfeA39IDIX1kiCf71tGlT
+            -----END CERTIFICATE-----
 ```
+
 In a dynamic configuration of a provider (ex docker) as a Label
+
 ```yaml
 services:
  whoami-foo:
@@ -71,26 +79,34 @@ The service `whoami-foo` will authenticate with an **API key** over HTTPS after
 The service `whoami-bar` will authenticate with a **client certificate** signed by the CA.

 Access to a route that communicate via https and authenticate with API-key:
+
 ```
 curl http://localhost:8000/foo
 ```
+
 Access to a route that communicate via https and authenticate with a client certificate:
+
 ```
 curl http://localhost:8000/bar
 ```
+
 Access to the traefik dashboard
+
 ```
 curl http://localhost:8080/dashboard/#/
 ```

 To play the demo environnement run:
+
 ```bash
 make run_tlsauth
 ```

 Note:
-> Traefik need to be restarted if certificates are regenerated after his launch
+
+> Traefik need to be restarted if certificates are regenerated after his launch, crowdsec also

 ## Separate LAPI and Appsec HTTP/S config
+
 To separate TLS config for LAPI and Appsec, you can use all the TLS LAPI variable beginning with `CrowdsecLapi...` into `CrowdsecAppsec...`.
 Don't forget to set `CrowdsecAppsecScheme: HTTP` or `HTTPS` to trigger the separate setup.
@@ -2,3 +2,12 @@ filenames:
 - /var/log/traefik/access.log
 labels:
  type: traefik
+---
+listen_addr: 0.0.0.0:7422
+appsec_config: crowdsecurity/virtual-patching
+name: myAppSecComponent
+source: appsec
+labels:
+  type: appsec
+cert_file: /etc/crowdsec/certs/server.pem
+key_file: /etc/crowdsec/certs/server-key.pem
@@ -1,6 +1,6 @@
 services:
  traefik:
-    image: "traefik:v3.0.0"
+    image: "traefik:v3.5.0"
    container_name: "traefik"
    restart: unless-stopped
    command:
@@ -13,15 +13,13 @@ services:
      - "--entrypoints.web.address=:80"

      - "--experimental.plugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
-      - "--experimental.plugins.bouncer.version=v1.3.0"
+      - "--experimental.plugins.bouncer.version=v1.5.0"
      # - "--experimental.localplugins.bouncer.modulename=github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./LAPIKEY:/etc/traefik/LAPIKEY:ro
      - logs-tls-auth:/var/log/traefik
      - crowdsec-certs-tls-auth:/etc/traefik/crowdsec-certs
      # - ./../../:/plugins-local/src/github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin
-
    ports:
      - 8000:80
      - 8080:8080
@@ -29,7 +27,7 @@ services:
      - crowdsec
      - gencert

-# Use HTTPS scheme but with lapikey authentication
+  # Use HTTPS scheme but with lapikey authentication
  # whoami-foo:
  #   image: traefik/whoami
  #   container_name: "simple-service-foo"
@@ -38,7 +36,7 @@ services:
  #     - "traefik.enable=true"
  #     - "traefik.http.routers.router-foo.rule=Path(`/foo`)"
  #     - "traefik.http.routers.router-foo.entrypoints=web"
-  #     - "traefik.http.routers.router-foo.middlewares=crowdsec@docker" 
+  #     - "traefik.http.routers.router-foo.middlewares=crowdsec@docker"
  #     - "traefik.http.services.service-foo.loadbalancer.server.port=80"
  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
@@ -46,34 +44,41 @@ services:
  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
  #     - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"

-# Use HTTPS scheme with TLS cert authentication
+  # Use HTTPS scheme with TLS cert authentication
  whoami-bar:
    image: traefik/whoami
    container_name: "simple-service-bar"
    restart: unless-stopped
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.router-bar.rule=Path(`/bar`)"
+      - "traefik.http.routers.router-bar.rule=PathPrefix(`/bar`)"
      - "traefik.http.routers.router-bar.entrypoints=web"
      - "traefik.http.routers.router-bar.middlewares=crowdsec@docker"
      - "traefik.http.services.service-bar.loadbalancer.server.port=80"
      - "traefik.http.middlewares.crowdsec.plugin.bouncer.enabled=true"
      - "traefik.http.middlewares.crowdsec.plugin.bouncer.loglevel=DEBUG"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecMode=none"
      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdseclapischeme=https"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsecscheme=https"
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecAppsecTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
+
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapikey=40796d93c2958f9e58345514e67740e5="
      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateAuthorityFile=/etc/traefik/crowdsec-certs/inter.pem"
      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerFile=/etc/traefik/crowdsec-certs/bouncer.pem"
-      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"      
-
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecLapiTLSCertificateBouncerKeyFile=/etc/traefik/crowdsec-certs/bouncer-key.pem"
+      # Enable AppSec
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsecenabled=true"
+      # Define AppSec host and port informations
+      - "traefik.http.middlewares.crowdsec.plugin.bouncer.crowdsecappsechost=crowdsec:7422"
  crowdsec:
-    image: crowdsecurity/crowdsec:v1.6.1-2
+    image: crowdsecurity/crowdsec:latest
    container_name: "crowdsec"
    restart: unless-stopped
    environment:
-      COLLECTIONS: crowdsecurity/traefik
      CUSTOM_HOSTNAME: crowdsec
      # whoami-foo is authenticating with api key over https
      # whoami-bar is authenticating with tls cert over https
-      BOUNCER_KEY_TRAEFIK_FOO: 40796d93c2958f9e58345514e67740e5
+      BOUNCER_KEY_TRAEFIK_FOO: 40796d93c2958f9e58345514e67740e5=
      LOCAL_API_URL: https://127.0.0.1:8080
      USE_TLS: "true"
      CERT_FILE: "/etc/crowdsec/certs/server.pem"
@@ -88,6 +93,7 @@ services:
      # DISABLE_AGENT: "true"
      # Disabled for the examples
      DISABLE_ONLINE_API: "true"
+      COLLECTIONS: crowdsecurity/traefik crowdsecurity/appsec-virtual-patching crowdsecurity/appsec-generic-rules
    volumes:
      - ./config/acquis.yaml:/etc/crowdsec/acquis.yaml
      # - ./config/config.yaml:/etc/crowdsec/config_local.yaml
@@ -100,7 +106,7 @@ services:
      - "traefik.enable=false"
    depends_on:
      - gencert
-  
+
  gencert:
    build: .
    volumes:
@@ -1,6 +1,8 @@
 #!/bin/bash

-stdout=/out/res.log
+if [ -f "/out/inter-key.pem" ]; then
+  exit 0
+fi
 cfssl gencert --initca /in/ca.json 2>${stdout} | cfssljson --bare "/out/ca" && \
 # Generate an intermediate certificate that will be used to sign the client certificates
 cfssl gencert --initca /in/intermediate.json 2>${stdout} | cfssljson --bare "/out/inter"  && \